Security, data and compliance in Housing & Homelessness HMIS Wrapper

How Housing & Homelessness HMIS Wrapper protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Consent-based access

Each record view is checked against the client's consent and the sharing rules at the moment it is opened.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, share, referral and consent change is logged with the person, agency and time, and cannot be edited.

US hosting

Government and client data is hosted in the United States region only.

Business associate agreement

Where health information covered by HIPAA is involved, Moraph signs a business associate agreement.

Requirements it supports

• HUD HMIS Data Standards (HMIS Data Dictionary and HMIS Data Manual)
• HMIS Data and Technical Standards Final Notice (2004), including privacy and security standards
• Continuum of Care Program interim rule (24 CFR Part 578)
• Violence Against Women Act confidentiality provisions for victim service providers
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164), where covered entities participate
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, the only region used for government data.
• Dedicated environment: A single-tenant environment for Continuums of Care or counties whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for partner onboarding, sharing rule changes and support.

Limitations

• It is not an HMIS. Your HMIS remains the system of record, and HUD-required reports continue to be produced from it.
• Sharing follows the consent and agreements you configure; your Continuum of Care, its privacy officer and counsel decide what may be shared and with whom.
• Victim service providers do not enter client data into HMIS, and their clients' information is not shared through the Wrapper.
• Public safety partners can refer and see referral status but cannot see client records; it is not a tool for enforcement or locating individuals.
• Synchronization with the HMIS depends on what your HMIS vendor's API or exports support, and writing outcomes back is not available with every HMIS.
• It does not manage housing subsidies or payments to landlords. Moraph does not hold funds.
• Health information is shared only where a client consents and the participating organizations' agreements, including any business associate agreement, are in place.
• Coordinated entry prioritization policy is set by your Continuum of Care; the Wrapper applies and records it but does not decide it.